diff --git a/soup-discovery/scripts/find-staged-bundle.sh b/soup-discovery/scripts/find-staged-bundle.sh index 8f31cc5..688f6e2 100644 --- a/soup-discovery/scripts/find-staged-bundle.sh +++ b/soup-discovery/scripts/find-staged-bundle.sh @@ -3,12 +3,10 @@ # # track-lifecycle.py needs something to compare the running version against, or every finding # reads as `open` and the state this whole lifecycle exists for -- a fix that is merged and -# waiting to ship -- cannot be told apart from nobody having looked. Measured on mindnet: -# 125 findings in the deployed v1.0.15 are gone in v1.1.0-qa2, four of them Track 1. +# waiting to ship -- cannot be told apart from nobody having looked. # -# A QA bundle rather than a scan of main, because it already exists and already covers the -# images. A scan of main can only read the manifests, and on mindnet those hold 34 of 1756 -# findings -- the rest are OS packages inside the images we build. +# A QA bundle rather than a scan of main: it already exists, and it covers the images. A scan of +# main reads the manifests only, and most findings sit in OS packages inside the images we build. # # Younger than the deployed release, not merely the newest QA tag: an older QA bundle predates # the deployment and every finding fixed since would read as still open, or worse, findings the diff --git a/soup-discovery/scripts/merge-assessment.sh b/soup-discovery/scripts/merge-assessment.sh index a2776f7..10e7708 100755 --- a/soup-discovery/scripts/merge-assessment.sh +++ b/soup-discovery/scripts/merge-assessment.sh @@ -175,8 +175,7 @@ jq --slurpfile recs "$TMP/records.json" ' and .value == "direct")] | length) > 0) # Nothing outside was chosen: code from this repository, a package the toolchain # delivers, an image this build produces. mark-scope.py and normalize-bom.sh set the - # reason. Seven of the eight names on the first GDG run were of this kind, and they - # buried the one that was not. + # reason. | select(([.properties[]? | select(.name == "quickbird:soup:exempt")] | length) == 0) | . as $c | select(([ $records[] | select(name_matches(.; $c)) ] | length) == 0)